feat: prepare the datex4j 0.1.0 release foundation - #41
Merged
Conversation
juherr
marked this pull request as ready for review
July 25, 2026 12:36
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThe PR adopts Java 21, verifies Java 21/25 in CI, isolates versioned model dependencies, adds consumer classpath tests, makes JSON model handling version-neutral, hardens XML parsing and validation, caches JAXB contexts and schemas, and updates documentation and coverage checks. ChangesBuild and consumer classpath
Version-neutral JSON model handling
Secure XML processing and runtime caches
Toolchain and architecture documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant JaxbDatexMarshaller
participant SecureXmlSource
participant DatexValidator
Client->>JaxbDatexMarshaller: read XML InputStream
JaxbDatexMarshaller->>SecureXmlSource: create hardened SAXSource
SecureXmlSource-->>JaxbDatexMarshaller: return protected XML source
Client->>DatexValidator: validate XML InputStream
DatexValidator->>SecureXmlSource: create hardened SAXSource
SecureXmlSource-->>DatexValidator: return protected XML source
DatexValidator-->>Client: return validation result or exception
Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java (1)
1-56: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winConsolidate the duplicated fail-closed XML source factory.
SecureXmlSourceandSecureValidationSourceare byte-for-byte identical (same feature URIs, sameEntityResolver, samefrom(InputStream)contract), anddatex4j-validationalready depends ondatex4j-xml(DatexValidatorbuilds its marshaller viaDatexXml.builder()). Keeping two independent copies of this XXE/DTD hardening logic risks the two configurations drifting apart if a future mitigation is added to only one of them.
datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java: make this the single shared implementation (e.g., exposefrom(InputStream)publicly, or move the class to a shared internal package consumable bydatex4j-validation).datex4j-validation/src/main/java/dev/juherr/datex4j/validation/SecureValidationSource.java: remove this duplicate and delegate todatex4j-xml'sSecureXmlSource.from(...)instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java` around lines 1 - 56, Consolidate the duplicated fail-closed XML source implementation: in datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java, expose SecureXmlSource.from(InputStream) for cross-module use; in datex4j-validation/src/main/java/dev/juherr/datex4j/validation/SecureValidationSource.java, remove the duplicate feature configuration and delegate callers to SecureXmlSource.from(...), preserving the existing contract and hardening behavior.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
26-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable persisted checkout credentials.
No later step needs authenticated Git operations. Add
persist-credentials: falseto reduce unnecessary token exposure; this also addresses the reported zizmor warning. (github.com)[details]
- name: Checkout uses: actions/checkout@... + with: + persist-credentials: false[/details]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 26, Update the actions/checkout step to set persist-credentials to false, keeping the existing pinned revision and version comment unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 17-23: Update the JaCoCo upload step in the CI workflow to use a
matrix-specific artifact name, jacoco-reports-java-${{ matrix.java }}, so each
Java matrix leg uploads a unique artifact.
In `@docs/guides/models-and-versions.md`:
- Around line 14-15: Update the sentence describing the XML and validation
facades to remove the duplicated “XML”, leaving exactly one “XML” before “and
validation facades”.
---
Outside diff comments:
In `@datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java`:
- Around line 1-56: Consolidate the duplicated fail-closed XML source
implementation: in
datex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.java, expose
SecureXmlSource.from(InputStream) for cross-module use; in
datex4j-validation/src/main/java/dev/juherr/datex4j/validation/SecureValidationSource.java,
remove the duplicate feature configuration and delegate callers to
SecureXmlSource.from(...), preserving the existing contract and hardening
behavior.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 26: Update the actions/checkout step to set persist-credentials to false,
keeping the existing pinned revision and version comment unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 72e9bbf1-da5f-4b0c-b4c5-b47cd3dd2c36
📒 Files selected for processing (40)
.github/workflows/ci.ymlCHANGELOG.mdCONTRIBUTING.mdREADME.mddatex4j-builders/pom.xmldatex4j-consumer-tests/pom.xmldatex4j-consumer-tests/src/test/java/dev/juherr/datex4j/consumer/SingleModelClasspathTest.javadatex4j-domain-evcharging/pom.xmldatex4j-domain-parking/pom.xmldatex4j-domain-srti/pom.xmldatex4j-domain-traffic/pom.xmldatex4j-domain-uvar/pom.xmldatex4j-integration-tests/pom.xmldatex4j-json/pom.xmldatex4j-json/src/main/java/dev/juherr/datex4j/json/DatexJson.javadatex4j-json/src/main/java/dev/juherr/datex4j/json/DatexJsonMapper.javadatex4j-json/src/main/java/dev/juherr/datex4j/json/internal/DatexJsonModule.javadatex4j-json/src/main/java/dev/juherr/datex4j/json/internal/MultilingualString36Json.javadatex4j-json/src/main/java/dev/juherr/datex4j/json/internal/MultilingualStringJson.javadatex4j-json/src/main/java/dev/juherr/datex4j/json/internal/package-info.javadatex4j-json/src/test/java/dev/juherr/datex4j/json/internal/MultilingualStringJsonTest.javadatex4j-location/pom.xmldatex4j-ocpi/pom.xmldatex4j-validation/pom.xmldatex4j-validation/src/main/java/dev/juherr/datex4j/validation/DatexValidator.javadatex4j-validation/src/main/java/dev/juherr/datex4j/validation/SecureValidationSource.javadatex4j-validation/src/test/java/dev/juherr/datex4j/validation/DatexValidatorTest.javadatex4j-validation/src/test/java/dev/juherr/datex4j/validation/ValidationResultTest.javadatex4j-xml/pom.xmldatex4j-xml/src/main/java/dev/juherr/datex4j/xml/ClasspathSchemas.javadatex4j-xml/src/main/java/dev/juherr/datex4j/xml/JaxbContexts.javadatex4j-xml/src/main/java/dev/juherr/datex4j/xml/JaxbDatexMarshaller.javadatex4j-xml/src/main/java/dev/juherr/datex4j/xml/SecureXmlSource.javadatex4j-xml/src/test/java/dev/juherr/datex4j/xml/DatexRoundtripTest.javadatex4j-xml/src/test/java/dev/juherr/datex4j/xml/DatexRuntimeCacheTest.javadatex4j-xml/src/test/java/dev/juherr/datex4j/xml/DatexXmlSecurityTest.javadocs/architecture.mddocs/guides/models-and-versions.mdmise.tomlpom.xml
💤 Files with no reviewable changes (1)
- datex4j-json/src/main/java/dev/juherr/datex4j/json/internal/MultilingualString36Json.java
This was referenced Jul 25, 2026
juherr
added a commit
that referenced
this pull request
Jul 25, 2026
feat: prepare the datex4j 0.1.0 release foundation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
The current dependency graph makes lightweight model selection unreliable, while JAXB and validation accept XML parser features that are unsafe for untrusted feeds. The first public release also needs an explicit Java baseline, measurable coverage gates, and a reproducible consumer-level dependency check.
Impact
Consumers can install one DATEX II model version without resolving the full model aggregate. XML processing rejects dangerous document constructs before JAXB or schema validation. Existing typed facade methods remain available, while missing JSON model artifacts now produce explicit diagnostics.
Validation
./mvnw clean verifygit diff --checkfix #9
fix #10
fix #11
fix #13
Refs #12
Refs #18
Summary by CodeRabbit
New Features
Bug Fixes
Performance
Documentation